feat(session,client): AI session titles, path resume, and per-model anthropic-beta gating (#19)

## Summary

Three user-visible session features, plus a per-request beta-header fix
and `[1m]` opt-in for 1M context:

- **AI-generated session titles** — the first user prompt on a fresh
session spawns a detached Haiku call; the result lands as a new
`Entry::Title { source: AiGenerated }` and refreshes the TUI status bar
live. One-shot per session; failures warn-log and leave the first-prompt
fallback title in place. Haiku is pinned to a `{title: string}` JSON
schema via the `structured-outputs-2025-12-15` beta so the reply can
never drift into a conversational refusal.
- **Resume by external path** — `ox -c ` resumes session files that live
outside the XDG project subdirs. UUID-shaped prefixes keep working
unchanged.
- **Session title in the TUI status bar** — new slot between model and
status, with ellipsis truncation and graceful drop under narrow widths.
- **Per-request `anthropic-beta` gated on target model** — `Client::new`
no longer stuffs a one-size-fits-all beta set into default headers.
`compute_betas(model, auth, is_agentic, want_structured)` now emits the
right subset per call, fixing `HTTP 400` on subscriptions / gateways
that reject unsupported betas (Haiku + 1M being the common failure).
Full mapping in `docs/research/anthropic-api.md` → "Per-model beta
sets".
- **`[1m]` tag for 1M-context opt-in** — append `[1m]` to `model` (e.g.,
`claude-opus-4-7[1m]`) to enable the 1M-context beta; family-based
auto-enable was removed for the same subscription-mismatch reason. Tag
is stripped before the wire, and a shared `tag_offset` helper keeps
`has_1m_tag` and `api_model_id` in lockstep on case.

Preparatory refactors land as separate commits:

- New `crate::model` module — single `MODELS` table with per-row
`Capabilities` (interleaved thinking, context management, effort, 1M,
structured outputs) spelled out per model, replacing scattered
`is_opus_*` / `is_sonnet_*` / `is_haiku_*` substring checks in both
`client::anthropic` and `prompt::environment`. Bumping for a new model
is now a single-row edit, and a test pins every row's substring-derived
flags against the `modelSupports*`-style predicates the 3P gateway
expects.
- `Action` → `UserAction` collapse across the TUI reducer.
- Shared assistant-markdown renderer extracted from `ChatView`.
- New `session::history` module hoists `ToolUse` / `ToolResult` pairing
out of `ChatView`.
- Non-streaming `Client::complete` helper for background tasks, now also
threading an optional `OutputFormat` for JSON-schema-constrained
replies.
- `docs/research/session-persistence.md` restructured to match
`tui.md`'s research-doc shape.

Review-pass follow-ups before merge:

- `session/writer.rs` moves from 0% to ~99% coverage via direct tests of
`record_session_message` and all four branches of `log_session_err`;
negative-result test idiom standardized on `.err().unwrap()`; scattered
error paths covered in `session/store`, `session/resolver`, and
`tui/components/chat`.
- `store::read_session_info` now performs a single linear full-file scan
tracking the latest `Entry::Title` / `Entry::Summary` by `updated_at`.
The prior head-plus-4KB-tail scan left a dead zone that buried
AI-generated titles behind large `tool_result` entries, so `ox --list`
silently fell back to the first-prompt title.

## Test plan

- [x] `cargo fmt --all --check`, `cargo clippy --all-targets -- -D
warnings`, `cargo test` (733 pass)
- [x] `pnpm lint`, `pnpm spellcheck`
- [x] `cargo llvm-cov` — ~93% line / ~92% region
- [x] Manual: first prompt triggers the AI title within a few seconds
and the schema blocks conversational replies from Haiku; `ox --list`
picks up AI titles even when preceded by multi-KB tool outputs;
UUID-prefix and `.jsonl` path resume both work; `claude-opus-4-7[1m]`
opts into 1M, plain `claude-opus-4-7` does not.

## Deferred

HTTP round-trip coverage for `Client::complete`, `stream_message`, and
`title_generator::generate_and_record` needs a live mock. The principled
fix is adopting `wiremock` as a dev-dep in a follow-up PR rather than a
hand-rolled workaround here.

`/model` slash command and related runtime-switch plumbing is also a
follow-up — the `[1m]` tag convention is designed so the switch can
cleanly toggle it alongside the model string, and `crate::model::MODELS`
is now the natural data source for its picker.

Author: hakula139

.cspell/words.txt

@@ -1,3 +1,4 @@
+agentic
 anthropic
 anthropics
 anyhow

.markdownlint-cli2.jsonc

@@ -48,5 +48,11 @@
     "MD050": { "style": "asterisk" },
   },
 
-  "ignores": [".claude/agent-memory-local/", ".claude/plans/", ".venv/", "node_modules/"],
+  "ignores": [
+    ".claude/agent-memory-local/",
+    ".claude/plans/",
+    ".venv/",
+    "node_modules/",
+    "target/",
+  ],
 }

CLAUDE.md

@@ -36,6 +36,7 @@ ox     # Start an interactive session
 │   └── oauth.rs                # Claude Code OAuth credentials (macOS Keychain + file), token refresh, directory-based advisory lock
 ├── main.rs                     # CLI entry point, mode dispatch (TUI / REPL / headless), signal handling
 ├── message.rs                  # Conversation message types
+├── model.rs                    # Ground-truth table of known Claude models (marketing name, cutoff, capability flags)
 ├── prompt.rs                   # System prompt builder (section assembly)
 ├── prompt/
 │   ├── environment.rs          # Runtime environment detection (platform, git, date, marketing name)
@@ -44,11 +45,13 @@ ox     # Start an interactive session
 ├── session.rs                  # Session module root
 ├── session/
 │   ├── entry.rs                # JSONL entry types (Header, Message, Title, Summary) and metadata structs
+│   ├── history.rs              # Transcript → display interaction stream (pair ToolUse with ToolResult inline)
 │   ├── list_view.rs            # `ox --list` table rendering (writes to any `impl Write`)
 │   ├── manager.rs              # SessionManager: lifecycle (start, resume, record, finish)
 │   ├── path.rs                 # Filesystem-safe project subdirectory derivation (sanitize_cwd)
 │   ├── resolver.rs             # CLI `--continue` argument resolution (ResumeMode, resolve_session)
 │   ├── store.rs                # SessionStore / SessionWriter: file I/O, XDG path, listing
+│   ├── title_generator.rs      # Background AI title generation (Haiku) with detached task
 │   └── writer.rs               # Session-write helpers (record_session_message, log_session_err)
 ├── tool.rs                     # Tool trait, registry, definitions
 ├── tool/
@@ -61,7 +64,7 @@ ox     # Start an interactive session
 ├── tui.rs                      # TUI module root
 ├── tui/
 │   ├── app.rs                  # Root App struct, tokio::select! event loop, render dispatch
-│   ├── component.rs            # Component trait and Action enum
+│   ├── component.rs            # Component trait (components report UserAction back to the agent loop)
 │   ├── components.rs           # Components module root
 │   ├── components/
 │   │   ├── chat.rs             # Scrollable chat with markdown, tool styling, thinking display

crates/oxide-code/src/agent/event.rs

@@ -41,6 +41,9 @@ pub(crate) enum AgentEvent {
     /// The current assistant turn is complete (text-only response, no more
     /// tool calls).
     TurnComplete,
+    /// A newly-generated session title (e.g., AI-generated via Haiku). The
+    /// TUI updates the status bar slot; other sinks ignore it.
+    SessionTitleUpdated(String),
     /// A fatal error from the API or agent loop.
     Error(String),
 }
@@ -131,10 +134,103 @@ impl AgentSink for StdioSink {
                 // Newline after streamed text.
                 println!();
             }
+            AgentEvent::SessionTitleUpdated(_) => {
+                // Titles are a TUI-only affordance; the stdio sink has no
+                // persistent header to rewrite.
+            }
             AgentEvent::Error(msg) => {
                 eprintln!("Error: {msg}");
             }
         }
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::tool::ToolRegistry;
+
+    // ── StdioSink::send ──
+    //
+    // `send` writes to stdout/stderr, which cargo's test harness captures and
+    // discards on success — so these tests exercise the match-arm dispatch
+    // and the Result contract rather than asserting on rendered bytes.
+    // Formatting-assertion tests belong behind an extracted rendering helper
+    // (see `docs/roadmap.md` → Test Coverage).
+
+    fn test_sink(show_thinking: bool) -> StdioSink {
+        StdioSink::new(show_thinking, Arc::new(ToolRegistry::new(Vec::new())))
+    }
+
+    #[test]
+    fn send_session_title_updated_is_silent_ok() {
+        // AI-generated titles are a TUI-only affordance; the stdio path has
+        // no persistent header to rewrite, so the arm must no-op cleanly.
+        let sink = test_sink(false);
+        sink.send(AgentEvent::SessionTitleUpdated("New title".to_owned()))
+            .unwrap();
+    }
+
+    #[test]
+    fn send_stream_token_writes_body_without_error() {
+        let sink = test_sink(false);
+        sink.send(AgentEvent::StreamToken("hello".to_owned()))
+            .unwrap();
+    }
+
+    #[test]
+    fn send_thinking_token_respects_show_thinking_flag() {
+        // show_thinking = false must swallow the block entirely, not just
+        // strip the dim escape codes — otherwise the stream lines bleed
+        // into the transcript unformatted.
+        test_sink(false)
+            .send(AgentEvent::ThinkingToken("muted".to_owned()))
+            .unwrap();
+        test_sink(true)
+            .send(AgentEvent::ThinkingToken("visible".to_owned()))
+            .unwrap();
+    }
+
+    #[test]
+    fn send_tool_call_start_renders_label_and_falls_back_to_name() {
+        let sink = test_sink(false);
+        sink.send(AgentEvent::ToolCallStart {
+            id: "t1".to_owned(),
+            name: "unregistered".to_owned(),
+            input: serde_json::Value::Null,
+        })
+        .unwrap();
+    }
+
+    #[test]
+    fn send_tool_call_end_handles_every_field_nullability() {
+        let sink = test_sink(false);
+        sink.send(AgentEvent::ToolCallEnd {
+            id: "t1".to_owned(),
+            title: Some("ls".to_owned()),
+            content: "file1\nfile2\n".to_owned(),
+            is_error: false,
+        })
+        .unwrap();
+        sink.send(AgentEvent::ToolCallEnd {
+            id: "t2".to_owned(),
+            title: None,
+            content: "   \n".to_owned(),
+            is_error: true,
+        })
+        .unwrap();
+    }
+
+    #[test]
+    fn send_turn_complete_emits_trailing_newline_without_error() {
+        test_sink(false).send(AgentEvent::TurnComplete).unwrap();
+    }
+
+    #[test]
+    fn send_error_routes_message_to_stderr() {
+        test_sink(false)
+            .send(AgentEvent::Error("boom".to_owned()))
+            .unwrap();
+    }
+}